implementing-threat-modeling-with-mitre-attack

name	implementing-threat-modeling-with-mitre-attack
description	Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","mitre-attack","threat-modeling","ttp","detection-coverage","attack-navigator","risk-assessment"]
version	1.0
author	mahipal
license	Apache-2.0

Implementing Threat Modeling with MITRE ATT&CK

When to Use

Use this skill when:

• SOC teams need to assess detection coverage against relevant threat actors and their TTPs
• Security leadership requires threat-informed defense prioritization
• New environments (cloud migration, OT integration) need detection strategy planning
• Purple team exercises require structured adversary emulation based on threat models
• Annual risk assessments need ATT&CK-based threat landscape analysis

Do not use as a one-time exercise — threat models must be continuously updated as adversary TTPs evolve and organizational attack surface changes.

Prerequisites

• MITRE ATT&CK framework knowledge (Enterprise, ICS, Mobile, or Cloud matrices)
• ATT&CK Navigator tool (web or local) for layer visualization
• Current detection rule inventory mapped to ATT&CK technique IDs
• Threat intelligence on adversary groups targeting your sector
• Organizational asset inventory with criticality classifications

Workflow

Step 1: Identify Relevant Threat Actors

Research adversary groups targeting your sector using MITRE ATT&CK Groups:

import requests
import json

# Download ATT&CK STIX data
response = requests.get(
    "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
)
attack_data = response.json()

# Extract groups and their techniques
groups = {}
for obj in attack_data["objects"]:
    if obj["type"] == "intrusion-set":
        group_name = obj["name"]
        aliases = obj.get("aliases", [])
        description = obj.get("description", "")
        groups[group_name] = {
            "aliases": aliases,
            "description": description[:200],
            "techniques": []
        }

# Map techniques to groups via relationships
relationships = [obj  obj  attack_data[]  obj[] == ]
techniques = {obj[]: obj  obj  attack_data[]
               obj[] == }

 rel  relationships:
     rel[] == :
        source = rel[]
        target = rel[]
         group_name, group_data  groups.items():
             source == group_data.get()  target  techniques:
                tech = techniques[target]
                ext_refs = tech.get(, [])
                 ref  ext_refs:
                     ref.get() == :
                        group_data[].append(ref[])


financial_actors = [, , , , ]
 actor  financial_actors:
     actor  groups:
        ()
        ()